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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (Currently Amended) A system comprising: 

a participant subsystem that is authorized to anonymously participate in a plurality of 
sessions using secret information provided by a manager subsystem , all of said secret 
information being transmitted to the participant subsystem prior to participation in a first of 
said plurality of sessions, said secret information enabling participation in each oXthe 
plurality of sessions : and 

a reception subsystem that determines whether it is acceptable for the participant 
subsystem to participate in a session, 

wherein the participant subsystem comprises: 

an anonymous signing section for authorizing individual data using the secret 
information depending on session-related information to produce anonymous participation 
data with an anonymous signature, and 

wherein the reception subsystem comprises: 

an anonymous signature determining section for determining whether received 
data is said anonymous participation data with said anonymous signature authorized by the 
participant subsystem; and 

a sender match determining section for determining whether anonymous 
signatures o f arbitrary two arbitrary pieces of anonymous participation data are signed by an 
identical participant subsystem. 

2. (Original) The system according to claim 1, wherein the anonymous signature includes 
data that is generated by a predetermined expression using the session-related information and 
the secret information, wherein the sender match determining section checks the data 
included in the anonymous signature of received anonymous participation data. 
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3. (Original) The system according to claim 2, wherein the predetermined expression is 
represented by raising a session-dependent base to a power that is dependent on the secret 
information. 

4. (Original) The system according to claim 1, wherein the anonymous signing section 
authorizes the individual data based on a group signature scheme. 

5. (Original) The system according to claim 1, wherein the anonymous signing section 
authorizes the individual data based on an escrowed identity scheme. 

6. (Original) The system according to claim 1, wherein the anonymous signing section 
comprises: 

a generator creating section for creating a session-dependent generator depending on 
the session-related information; 

a group signing section for signing the individual data using the session-dependent 
generator and the secret information to produce anonymous participation data, wherein the 
anonymous participation data includes data obtained by raising the session-dependent 
generator to a power determined by the secret information; and 

a linkage data generating section for generating linkage data indicating a relationship 
among the session-dependent generator and a generator determined by the individual data 
and/or the session-related information. 

7. (Original) The system according to claim 6, wherein the secret information is represented 
by (x, y 9 v) that satisfies: v = (y + 8) Ve mod n, where y = a x mod n, n is a product of two prime 
numbers as used in the RSA cryptography, g is a generator that generates a cyclic group of 
order n 9 a is an integer mutually prime to n, e is an integer mutually prime to the Euler 
number of n, and 5 is a constant other than 1, 

the generator creating section creates a session-dependent generator g A corresponding 
to a session A and a generator g m is generated based on the individual data m and/or the 
session A, 

the group signing section sets z = g/ and generates a first proof statement 
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V\ = SKLOGLOG(z ? ^,a)[a:z = ^(^ a )](l) 
proving the knowledge of a satisfying z =g^( a<X )' and a second proof statement 
V 2 = SKROOTLOG(z*^ 6 ,^ 5 e)[p: z*^ 6 = ^(p e )](l) 

proving the knowledge of (3 satisfying z*g A = ), 

the linkage data generating section sets z x = g m y , and generates a third proof statement 

V 3 = SKREP(z!/z, g m /g A )[y: z x iz =(gJg A ) y ](l) 
proving the knowledge of z\ and z have the same power to the bases g m and g Ay respectively, 

wherein the anonymous participation data is defined as (A, m, z, z\ 9 V\, V2, Vi). 

8. (Original) The system according to claim 7, wherein 

the anonymous signature determining section checks V\, V2, and F3 of the anonymous 
participation data to determine whether received data is anonymous participation data with 
anonymous signature authorized by the participant subsystem, and 

the sender match determining section checks z of the anonymous participation data to 
determine whether anonymous signatures of arbitrary two pieces of anonymous participation 
data are signed by an identical participant subsystem. 

9. (Original) The system according to claim 1 , wherein the anonymous signing section 
comprises: 

a generator creating section for creating a generator depending on the session-related 
information; 

a group signing section for signing the individual data using the generator and the 
secret information to produce anonymous participation data, wherein the anonymous 
participation data includes data obtained by raising the session-dependent generator to a 
power determined by the secret information. 

1 0. (Currently Amended) The system according to claim 9, wherein the secret information is 
represented by (x, y, v) that satisfies: v = (y + 5) 1/e mod n, where y = a x mod n, the individual 
data is denoted by m, n is a product of two prime numbers as used in the RSA cryptography, g 
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is a generator that generates a cyclic group of order «, a is an integer mutually prime to n 9 e is 
an integer mutually prime to the Euler number of «, and 5 is a constant other than 1, 

the generator creating section creates a session-dependent generator g A corresponding 
to a session^, 

the group signing section sets z = g/ and generates a first proof statement 

V x = SKLOGLOG(z,^,a)[a:z =^(« a )](m) 

proving the knowledge of a satisfying z = g^fa*)* and a second proof statement 

V 2 - SKROOTLOG(z*g/,^,e)[p: z*g A 8 = g A (P e )](m) 

proving the knowledge of P satisfying z*g A S = gA^ & \ 

wherein the anonymous participation data-43- is designated as (A, m, z, V\ 9 V 2 ). 

1 1 . (Original) The system according to claim 10, wherein 

the anonymous signature determining section checks V\ 9 and V 2 of the anonymous 
participation data to determine whether received data is anonymous participation data with 
anonymous signature authorized by the participant subsystem, and 

the sender match determining section checks z of the anonymous participation data to 
determine whether anonymous signatures of arbitrary two pieces of anonymous participation 
data are signed by an identical participant subsystem. 

12. (Original) The system according to claim 1, wherein the anonymous signing section 
comprises: 

a generator creating section for creating a session-dependent generator depending on 
the session-related information; 

an escrow identifying section for signing the individual data using the session- 
dependent generator and the secret information to produce anonymous participation data, 
wherein the anonymous participation data includes data obtained by raising the session- 
dependent generator to a power determined by the secret information; and 

a linkage data generating section for generating linkage data indicating a relationship 
among the session-dependent generator and a generator determined by the individual data 
and/or the session-related information. 
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13. (Original) The system according to claim 12, wherein the secret information is 
represented by (a, b) that satisfies b = (a e - 8) 1/e mod n, where n is a product of two prime 
numbers as used in the RSA cryptography, g is a generator that generates a cyclic group of 
order n, a is an integer mutually prime to n, e is an integer mutually prime to the Euler 
number of n, and 8 is a constant other than 1, 

the generator creating section creates a session-dependent generator gA corresponding 
to a session A and a generator g m is generated based on the individual data m and/or the 
session^, 

the escrow identifying section sets z a = and generates a first proof statement 

V\ = SKROOTLOG(z fl ,^,e)[a: z a = g A ^ e )](l) 
proving the knowledge of a satisfying z a = gj< a& )> and sets z b = g^(^) and generates a second 
proof statement 

V 2 = SKROOTLOG(z^ 5 e)[P: z b = ^(^1(1) 
proving the knowledge of P satisfying z^ = gA^X and 

the linkage data generating section sets z c = gj^) and generates a third proof 
statement 

V 3 = SKREP(z c /z„, gjgx)[y: z c /z a = (gJgA) y ](l) 
proving the knowledge of z a and z c having the same power to the bases g A and g m , 
respectively, 

wherein the anonymous participation data is defined as (A, m y z a , z b , z c , V\, ^2, F 3 ). 

14. (Original) The system according to claim 13, wherein 

the anonymous signature determining section determines whether z a iz b = g A is 
satisfied and checks V\ 9 V 2 , and F3 of the anonymous participation data to determine whether 
received data is anonymous participation data with anonymous signature authorized by the 
participant subsystem, and 

the sender match determining section checks one of z a and z b of the anonymous 
participation data to determine whether anonymous signatures of arbitrary two pieces of 
anonymous participation data are signed by an identical participant subsystem. 
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15. (Original) The system according to claim 1, wherein the anonymous signing section 
comprises: 

a generator creating section for creating a session-dependent generator depending on 
the session-related information; and 

an escrow identifying section for signing the individual data using the session- 
dependent generator and the secret information to produce anonymous participation data, 
wherein the anonymous participation data includes data obtained by raising the session- 
dependent generator to a power determined by the secret information. 

16. (Original) The system according to claim 15, wherein the secret information is 
represented by (a, b) that satisfies b = (a e - 8) 1/e mod n, where n is a product of two prime 
numbers as used in the RSA cryptography, g is a generator that generates a cyclic group of 
order «, a is an integer mutually prime to «, e is an integer mutually prime to the Euler 
number of «, and 5 is a constant other than 1, 

the generator creating section creates a session-dependent generator g A corresponding 
to a session A, 

the escrow identifying section sets z a = and generates a first proof statement 

Vi = SKROOTLOG(z fl ,^,e)[a: z a =g A i a ^\im) 
proving the knowledge of a satisfying z a = gA^ a ^ 9 and sets z b = gA^*) and generates a second 
proof statement 

V 2 = SKROOTLOG(z 6 ,^,e)[P: z b = g A (!> e )](m) 

proving the knowledge of (3 satisfying z& = gA^*), 

wherein the anonymous participation data is defined as {A, m, z ay z^ V\ 9 Vi), 

17. (Original) The system according to claim 16, wherein 

the anonymous signature determining section determines whether zjzb = gA is 
satisfied and checks V\ and Vi of the anonymous participation data to determine whether 
received data is anonymous participation data with anonymous signature authorized by the 
participant subsystem, and 
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the sender match determining section checks one of z a and z b of the anonymous 
participation data to determine whether anonymous signatures of arbitrary two pieces of 
anonymous participation data are signed by an identical participant subsystem. 

18. (Currently Amended) An anonymous participation authority management method for a 
system ^ comprising: the system comprising a participant subsystem that is authorized to 
anonymously participate in a plurality of sessions using secret information; information, and a 
reception subsystem that determines whether it is acceptable for the participant subsystem to 
participate in a session, the method comprising the steps of: 

at the participant subsystem, 

a) authorizing individual data using the secret information depending on 
session-related information to produce anonymous participation data with_an anonymous 
signature , all of said secret information being transmitted to the participant subsystem prior to 
participation in a first of said plurality of sessions, said secret information enabling 
participation in each of the plurality of sessions ; 

at the reception subsystem, 

b) determining whether received data is said anonymous participation data 
wit h said anonymous signature authorized by the participant subsystem; and 

c) determining whether anonymous signatures o f arbitrary two arbitrary pieces 
of anonymous participation data are signed by an identical participant subsystem. 

19. (Original) The method according to claim 18, wherein the anonymous signature includes 
data that is generated by a predetermined expression using the session-related information and 
the secret information, wherein the step (c) is performed by checking the data included in the 
anonymous signature of received anonymous participation data. 

20. (Original) The method according to claim 19, wherein the predetermined expression is 
represented by raising a session-dependent base to a power that is dependent on the secret 
information. 
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21. (Original) The method according to claim 18, wherein the step (a) comprises the steps 
of: 

creating a session-dependent generator depending on the session-related information; 

signing the individual data using the session-dependent generator and the secret 
information to produce anonymous participation data, wherein the anonymous participation 
data includes data obtained by raising the session-dependent generator to a power determined 
by the secret information; and 

generating linkage data indicating a relationship among the session-dependent 
generator and a generator determined by the individual data and/or the session-related 
information. 

22. (Original) The method according to claim 18, wherein the step (a) comprises the steps 
of: 

creating a session-dependent generator depending on the session-related information; 

and 

signing the individual data using the session-dependent generator and the secret 
information to produce anonymous participation data, wherein the anonymous participation 
data includes data obtained by raising the session-dependent generator to a power determined 
by the secret information. 
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